wp2shell: WordPress Core REST API Batch-Route Confusion Chained with author__not_in SQL Injection (CVE-2026-63030 / CVE-2026-60137) Yields Unauthenticated Pre-Auth RCE

wp2shell: WordPress Core REST API Batch-Route Confusion (TL-2026-1463), also tracked as wp2shell, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-17 and last reviewed 2026-08-22. It has no confirmed attribution, affects WordPress Foundation / Automattic WordPress Core, references 2 CVEs (CVE-2026-60137, CVE-2026-63030), maps to 51 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 90 indicators of compromise.

Key facts for TL-2026-1463

Threat ID
TL-2026-1463
Also known as
wp2shell
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-08-22
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
government administration, education, news - media, ecommerce, small-business, nonprofit, health, technology, publishing
Target regions
Global
Detection rules
9
Indicators of compromise
90
Updates
2026-08-22 · 9 updates · revalidated 9× · latest source

Malware and tooling in wp2shell: WordPress Core REST API Batch-Route Confusion

Malware and tooling: wp2shell.com checker

Security researcher Adam Kues (Assetnote / Searchlight Cyber) disclosed via HackerOne that WordPress core's REST API batch endpoint (/wp-json/batch/v1) suffers a route-confusion weakness (CVE-2026-63030, CWE-436) that, chained with an unsanitized author__not_in WP_Query parameter SQL injection (CVE-2026-60137, CWE-89, CVSS 9.1), allows a fully unauthenticated attacker to achieve remote code execution on default WordPress installations with zero plugins required. WordPress shipped emergency fixes in 6.8.6, 6.9.5, 7.0.2, and 7.1 beta2 on 2026-07-17; no public PoC and no confirmed in-the-wild exploitation as of 2026-07-18.

How wp2shell: WordPress Core REST API Batch-Route Confusion works

wp2shell is the public nickname (via the researcher's own checker tool at wp2shell.com and coverage on The Hacker News) for a two-bug exploit chain in WordPress core. The first bug, CVE-2026-63030, is a route-confusion weakness (CWE-436, Interpretation Conflict) in the REST API batch endpoint /wp-json/batch/v1, introduced when the batch endpoint shipped in WordPress 5.6 (released 2020-12-08) but which only became practically exploitable once WordPress 6.9 shipped (released 2025-12-02), per the researcher's own scoping notes. The batch endpoint allows a single unauthenticated HTTP request to be internally re-dispatched as a set of sub-requests; the confusion issue lets an attacker cause the batch dispatcher to route an internal sub-request in a way that reaches WP_Query with attacker-controlled parameters that would normally be inaccessible pre-authentication.

The second bug, CVE-2026-60137 (CVSS 3.1: 9.1 CRITICAL, CWE-89 SQL Injection), is an independent flaw in WP_Query itself: the author__not_in parameter is not properly sanitized before being incorporated into the generated SQL, so any code path (plugin, theme, or — as this chain demonstrates — WordPress core itself via the batch/REST confusion) that passes untrusted input into author__not_in is SQL-injectable. On its own, CVE-2026-60137 requires a plugin/theme to expose the parameter to untrusted input; the wp2shell chain's contribution is proving that WordPress core's own REST API batch route confusion supplies that untrusted-input path with zero plugins installed, turning a moderate-severity library bug into a critical, pre-auth, zero-plugin remote code execution primitive against the default install.

WordPress fixed both issues by patching three core files in the 7.0.2 release: wp-includes/rest-api/class-wp-rest-server.php, wp-includes/class-wp-query.php, and wp-includes/rest-api.php. The SQL injection (CVE-2026-60137) alone was also backported to 6.8.6 for sites on the 6.8 branch, which is not affected by the REST API route-confusion bug and therefore not vulnerable to the full RCE chain. WordPress 6.9.x and 7.0.x installations are vulnerable to the complete pre-auth RCE chain until patched to 6.9.5 or 7.0.2 respectively; 7.1 beta2 ships with both fixes.

Searchlight Cyber deliberately withheld exploit mechanics (specific batch payload construction, the exact SQLi-to-RCE pivot, and PoC code) at publication time to give defenders a patching window, publishing only affected-version ranges and interim mitigations. Interim mitigations recommended: WAF rules blocking both /wp-json/batch/v1 and ?rest_route=/batch/v1, disabling the REST API for unauthenticated users, or deploying a rest_pre_dispatch drop-in that rejects anonymous /batch/v1 requests. Researcher estimates put WordPress's install base above 500 million sites, with the vulnerable 6.9+ population being a smaller but still large subset of sites updated since December 2025.

MITRE ATT&CK techniques used in TL-2026-1463

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Discovery

T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.001 Account Discovery: Local Account; T1518 Software Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.011 Lua; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.003 Valid Accounts: Local Accounts; T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Persistence

T1098 Account Manipulation; T1136 Create Account; T1136.001 Create Account: Local Account; T1505 Server Software Component; T1505.003 Server Software Component: Web Shell

Credential Access

T1110.002 Brute Force: Password Cracking; T1110.004 Brute Force: Credential Stuffing; T1552.001 Unsecured Credentials: Credentials In Files

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.001 Defacement: Internal Defacement; T1491.002 Defacement: External Defacement; T1565.001 Data Manipulation: Stored Data Manipulation

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1587.001 Develop Capabilities: Malware; T1587.004 Develop Capabilities: Exploits; T1588.001 Obtain Capabilities: Malware; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

defense-impairment

T1685.006 Clear Linux or Mac System Logs

Affected products and versions in wp2shell: WordPress Core REST API Batch-Route Confusion

  • WordPress Foundation / Automattic — WordPress Core
    Vulnerable versions: 6.8.0-6.8.5 (SQL injection CVE-2026-60137 only); 6.9.0-6.9.4 (full RCE chain: CVE-2026-63030 + CVE-2026-60137); 7.0.0-7.0.1 (full RCE chain: CVE-2026-63030 + CVE-2026-60137); 7.1 beta through beta2 (pre-fix beta builds)
    Fixed in: 6.8.6; 6.9.5; 7.0.2; 7.1 beta2 (final beta2 build includes fix)

Remediation for wp2shell: WordPress Core REST API Batch-Route Confusion

Patches

  • WordPress 7.0.2 (patches CVE-2026-63030 and CVE-2026-60137)
  • WordPress 6.9.5 (patches CVE-2026-63030 and CVE-2026-60137)
  • WordPress 6.8.6 (patches CVE-2026-60137 only; 6.8 branch is not affected by CVE-2026-63030)
  • WordPress 7.1 beta2 (includes both fixes)

Immediate actions

  • Update WordPress core to 7.0.2 (from any 7.0.x), 6.9.5 (from any 6.9.x), or 6.8.6 (from any 6.8.x) immediately
  • If on 7.1 beta, update to 7.1 beta2 or later
  • Deploy a WAF rule blocking unauthenticated requests to /wp-json/batch/v1 and ?rest_route=/batch/v1
  • Deploy a rest_pre_dispatch drop-in mu-plugin to reject anonymous /batch/v1 requests as a stopgap before patching
  • Audit any custom plugin/theme code that passes user-controlled input into WP_Query's author__not_in parameter

Workarounds

  • Temporarily disable the WP REST API for unauthenticated users
  • Block /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF/reverse-proxy layer
  • Install a rest_pre_dispatch filter drop-in that rejects anonymous batch/v1 requests

Longer-term hardening

  • Enable automatic core security updates (WP_AUTO_UPDATE_CORE / minor auto-updates) so future emergency releases apply without manual intervention
  • Deploy runtime application self-protection (RASP) or SQLi-blocking WAF capable of catching injection chained through REST API batch dispatch
  • Restrict or authenticate REST API access for unauthenticated/anonymous users where business requirements allow
  • Monitor WordPress security release channels and CVE feeds for this CVE pair and related batch-endpoint follow-on research

CVEs associated with wp2shell: WordPress Core REST API Batch-Route Confusion

CVE-2026-60137, CVE-2026-63030

Weaknesses (CWE) in wp2shell: WordPress Core REST API Batch-Route Confusion

CWE-89, CWE-436, CWE-863, CWE-269, CWE-434

Timeline of wp2shell: WordPress Core REST API Batch-Route Confusion

Showing the 20 most recent tracked events.

  • The Hacker News publishes coverage of the wp2shell flaw; Searchlight Cyber publishes a summary writeup but withholds exploit mechanics and PoC code to protect unpatched defenders.
  • WordPress.org activates forced/mandatory automatic core updates for the affected 6.9.x/7.0.x branches given the pre-auth RCE severity, pushing the fix to sites that had not manually updated.
  • WordPress ships emergency security releases 6.8.6, 6.9.5, and 7.0.2 (plus 7.1 beta2) fixing both CVE-2026-63030 and CVE-2026-60137; three core files patched: class-wp-rest-server.php, class-wp-query.php, rest-api.php.
  • WordPress core team credits Adam Kues (Assetnote/Searchlight Cyber) for reporting the REST API batch-route confusion RCE chain via HackerOne, and TF1T, dtro, and haongo for the author__not_in SQL injection.
  • CVE-2026-63030 (REST API batch-route confusion + SQLi -> RCE) published in NVD with CVSS 3.1 base score 7.5; companion CVE-2026-60137 (author__not_in SQL injection) published with CVSS 9.1.
  • Public proof-of-concept exploits for the chained CVEs are published on GitHub despite coordinated disclosure efforts to withhold technical detail.
  • Aikido Security publishes technical/detection-oriented analysis; no confirmed in-the-wild exploitation reported as of this date.
  • watchTowr honeypots record tens of thousands of exploitation attempts following public PoC release; vulnerable-instance exposure drops from roughly 25% to 10% of WordPress organizations within 24 hours.
  • A further mass-exploitation wave begins in the early Saturday morning UTC hours using the public exploit code, per subsequent reporting.
  • Wiz Research confirms active in-the-wild exploitation and documents the CMSmap webshell toolkit and Overlord Golang RAT deployed against compromised sites.
  • Rapid7 makes authenticated vulnerability-check content available in its scanning products for CVE-2026-63030.
  • BleepingComputer reports patch adoption at roughly 81.6% across 124,580 evaluated WordPress sites, with active mass scanning and webshell deployment ongoing.
  • CISA adds CVE-2026-63030 (due 2026-07-24) and CVE-2026-60137 (due 2026-08-04) to the Known Exploited Vulnerabilities catalog.
  • An independent proof-of-concept, 0xsha/wp2shell, is released on GitHub alongside the already-recorded Icex0/wp2shell-poc, both implementing the full unauthenticated RCE chain.
  • Icex0/wp2shell-poc, a full public proof-of-concept implementing the unauthenticated RCE chain, is released on GitHub; a Nuclei detection template is merged shortly after, sharply accelerating mass exploitation.
  • Elastic Security Labs publishes 'wp2shell hits WordPress' detailing the plugin-drop-to-command-execution chain and ships six new Elastic Defend detection rules covering the attack lifecycle.
  • CISA BOD 22-01 remediation deadline for CVE-2026-63030 for FCEB agencies.
  • Bitdefender publishes an MDR-informed technical advisory on the wp2shell chain, contributing additional attacker source IPs, rogue-admin email domains, and malware/webshell SHA-256 sample hashes from its own telemetry.
  • CISA BOD 26-04 federal remediation deadline for CVE-2026-60137, mirroring the already-recorded 2026-07-24 deadline event for the companion CVE-2026-63030.
  • A one-month retrospective (Cyber Security News, authored by Pantheon CISO Joey Stanford) reports over 45 million exploit attempts from nearly 150,000 unique network sources in the first week post-disclosure — roughly 20x the scale of the 2018 Drupalgeddon2 mass-exploitation wave — establishing that mass exploitation now follows disclosure within hours rather than days.

Update history for TL-2026-1463

Sources cited for wp2shell: WordPress Core REST API Batch-Route Confusion

Threats related to wp2shell: WordPress Core REST API Batch-Route Confusion

Detection coverage for TL-2026-1463

As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1463 across Splunk SPL, Microsoft KQL and Sigma, covering 90 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats